Israeli spyware firm NSO Group faces renewed US scrutiny

NSO Group, an Israeli spyware firm, appears to be facing renewed scrutiny by the US Department of Justice(DoJ), a report by the UK’s Guardian newspaper said.

This came after WhatsApp, Google, Microsoft, Cisco and other leading technology companies said in December 2020 that the spyware maker was “powerful and dangerous” and should be held liable to the country’s anti-hacking laws.

The companies also said in the rare joint legal filing that the consequences of an “immunised and expanded” spyware industry would mean that more foreign governments would have access to “powerful and dangerous” cybersurveillance tools.

DoJ lawyers recently approached WhatsApp with technical questions about the targeting of 1,400 of its users by NSO Group’s government clients in 2019, according to a person with knowledge of the matter, said the report.

In 2020, WhatsApp said that 1,400 of its users, including diplomats, journalists, politicians and human rights advocates, were targeted by NSO Group’s spyware over a two-week period in 2019.

The targets included politicians and activists in Spain, journalists in India and Morocco, Rwandan dissidents in Europe and pro-democracy clergy members in Togo.

It also said that NSO Group was reportedly facing an FBI investigation in early 2020.

People familiar with the matter said it had seemed to stall, but that the DoJ was showing renewed interest in the case.

It is not clear which suspected hacking targets DoJ investigators are examining or what phase the investigation is in, the Guardian said.

WhatsApp declined to comment. NSO Group said it was not aware of an investigation.

The Israeli company, which makes hacking software that it sells to foreign governments and law enforcement authorities for the stated purpose of tracking terrorists and criminals, has faced a number of allegations that its clients have used its software to target journalists, government officials and human rights campaigners.

WhatsApp filed a lawsuit against the company in the US, claiming NSO Group had played a role in executing the attack against its users, said the newspaper.

NSO Group has denied the claim and has said it ought to be immune from such lawsuits because its clients are foreign governments and it is they who are responsible for deploying the software.

A US appeal court judge will soon decide whether NSO Group should be granted sovereign immunity in the civil case WhatsApp brought against it.

In a related blogpost in December, Microsoft’s president, Brad Smith, called on the incoming Biden administration to weigh in on the high-profile legal case, and compared NSO Group to 21st-century mercenaries.

The newspaper also said it is not clear why the DoJ’s investigation appeared to have stalled in the last year of Donald Trump’s administration, but sensitive investigations into foreign companies such as NSO Group, which is closely regulated by the Israeli defence ministry, tend to require cooperation with the US state department.

For years, campaigners such as Amnesty International have argued that the use of spyware poses a fundamental risk to human rights.